[Enrique Saurez (esaurez)]

Part of #845 (PR 3 of 3: the export and network settings).

Stacked on #959: this PR targets its branch, esaurez/845-pr2-workload-view-20261024, and is rebased and retargeted with it.

Chain: #951 → #954 → #957 → #959 → this PR, on dev; #879, #881, #885, #886, #877, #932, #884, #887, #933, #880, #936, #937, #939, #940, #941, #888, #949, and #950 have merged.

What and why

A clone's activation applied the record's root and workload view, but left its export and its network settings unapplied. It now applies both before Ready, as at a cold boot:

• If the record has an export, nvx::guest::clone::apply mounts the host export with Root::mount_export, through the template's host filesystem device, which the new RootTemplate::filesystem_tag names, whatever the export's shape: at hostfs/root of the runtime directory, outside the root, where only the guest's root user reaches it. The record names no mode of the mount, so it is read-write: OpenVMM limits each of the export's children to its own access, and each mapping takes its own. The documentation of that step states the rule that this relies on: OpenVMM resolves an export's path again at each launch and restore, so the directories above an export's directory must be ones that no guest may change, and whoever names an export must not name one inside a directory that a writable export of another sandbox or clone holds. Applied::take_export hands the adapter the export's SourceRoot, from which it maps the host's mapping table once the clone is ready, as after a cold boot.
• If the record's network names a DNS server, apply writes a resolver file that names it, as protocol::cmdline::write_resolver writes one, to the new RESOLVER_FILE, resolv.conf, in the runtime directory: a new file of mode 0444, whatever the umask. Entry::resolver binds it read-only over the root's /etc/resolv.conf, in the same Entry::bind_runtime as a generated machine ID, and Applied::resolver returns it.
• Applied::proxy returns the network's proxy endpoint. The test adapter's host tells its workloads, as after a cold boot: its exec adds the proxy's URL to each execution's environment, so the guest worker leaves each environment exactly its start's.

Applied's teardown, and its drop, close the export's root, unless the adapter took it, and remove the binds before they tear the root down, which unmounts the export. A mount that fails is ApplyError::Export, and a resolver file that cannot be written or bound is ApplyError::Network, with the new NetworkError, once the export's root is closed and the root torn down. The test adapter maps them to their own statuses, 56, ACTIVATION_EXPORT, and 57, ACTIVATION_NETWORK, so that each class of a clone's activation has its status. Listener publication stays unapplied. The cold path is unchanged: it mounts no export of a record and binds no resolver file.

Not in this PR

• Listener publication and its capability check (nvx-rs: per-clone network policies on deny-all templates #850).
• The host's export and mapping table, and the VM scenarios of the export, DNS and the proxy, which run with nvx-rs: exports, MAPS and network templates for clones #846.

Validation

At this PR's head efe51b4, the same commit as the earlier head 2674fd2, rebased onto #959's head c5abb73: its tree, 67454b3d, is the merge of 2674fd2 into dev at fbeb563, which holds #951, #954 and #957. CI at that head, in run 40890757646: 36 jobs passed, among them the microVM tests and the platform checks on KVM, MSHV and WHP, and OpenVMM's unit and VM tests; the six that run only for a pull request or on dev were skipped. On Windows, on that tree: the library's fmt, its Clippy with -D warnings in each configuration that check-nvx-rs lints and for the musl target, and its documentation with -D warnings; the test adapter's fmt, and its Clippy and documentation with -D warnings in its protocol-only, host and musl guest configurations, as check-nvx-rs builds them, with its clone_start tests; and validate-nvx's Windows checks, among them the scripts' unit tests. The rest of this section describes the validation at 2674fd2, on #954's head 21b9983.

Each commit of this PR, on #954's head 21b9983, with OpenVMM at 832d5bb4, the pin of its base: fmt, Clippy with -D warnings in every configuration of the library and of the test adapter, and the check that nvx-rs/README.md gives each module a short row and a section. At this PR's head:

• On Windows: tests/host_modules.rs; the test adapter's protocol-only tests, and its host tests of the library, the binaries, host_session and clone_start.
• On Linux x86_64: the aarch64-apple-darwin check; the library's guest::clone and guest::root tests; the test adapter's musl guest library tests and guest_session; and, as root, the ignored test that checks the partition-table reread against the kernel with a loop device, and, in a process of their own, the privileged tests of guest::mappings.
• The documentation with -D warnings, the MSRV checks of the library and of the test adapter's three configurations, and the Markdown links.

At this PR's head, the top of the stack, with OpenVMM at 832d5bb4:

• On Windows and on Linux x86_64, every step of check-nvx-rs: fmt; Clippy with -D warnings with all features and on the library with and without default features; the tests with all features and with the default ones; the library without default features; the documentation with -D warnings; and the MSRV check, with the aarch64-apple-darwin check on Linux.
• The test adapter's fmt, Clippy, build, tests and MSRV check, in its protocol-only and host configurations on both, and in its musl guest configuration on Linux.
• On Linux, the guest binaries' check, build and tests, and the Markdown links.
• On Linux, as root, three times each, the ignored tests of guest::mappings, of guest::clone::activation::apply, and of the partition-table reread with a loop device, each in a process of its own: guest::mappings' privileged tests can find a mount busy at their teardown when another test of the same process starts a child, as they do at runtime-adapter: start clones of templates #954's head.
• CI at the same head, in run 40829337538: 36 jobs passed, among them the microVM tests and the platform checks on KVM, MSHV and WHP, and OpenVMM's unit and VM tests; the six that run only for a pull request or on dev were skipped.
• The test adapter's VM suites, on Windows (WHP) and on Linux (MSHV), with OpenVMM's release build of 832d5bb4: vm_clone, 16 scenarios; vm_layered, 43; vm_restart, 3; vm_steps, 3; and vm_template, 9.

[Copilot]

🟢 Approval recommended

No active review issues were identified in the clone export-mount and network-setting changes.

No open issues 🎉

What changed in this PR

This PR adds export mounts and network settings to NVX’s clone activation, building on the root and workload-view work in #845. It prepares these settings before Ready while leaving host-side export planning and VM scenarios to #846, and listener publication to #850.

Changes:

• Mounts a clone’s export through the template’s filesystem device and hands its root to the adapter for mappings.
• Writes and binds a read-only DNS resolver file, exposes the proxy endpoint, and extends cleanup and activation failure statuses.
• Adds activation and adapter tests and updates documentation; cold-boot behavior remains unchanged.

File	Description
tests/​runtime-adapter/​tests/​guest_session.rs	Tests export mappings, network failures, and unchanged execution environments.
tests/​runtime-adapter/​src/​worker/​capture.rs	Includes the filesystem tag in clone root templates.
tests/​runtime-adapter/​src/​worker/​activation.rs	Maps export and network failures to statuses 56 and 57.
tests/​runtime-adapter/​src/​worker.rs	Retains the activated export for host mappings.
tests/​runtime-adapter/​README.md	Documents activation settings, cleanup, statuses, and tests.
nvx-rs/​src/​guest/​clone/​activation/​apply/​tests.rs	Tests export mounting, resolver files and binds, failure handling, and cleanup.
nvx-rs/​src/​guest/​clone/​activation/​apply.rs	Implements export and network activation and resource ownership.
nvx-rs/​src/​guest/​clone/​activation.rs	Re-exports the new API and updates adapter guidance.
nvx-rs/​src/​guest/​clone.rs	Exposes and documents the expanded activation API.
nvx-rs/​README.md	Updates the clone API overview.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues were identified for the guest-side export and network activation changes.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues remain for the guest-side export mounting and DNS activation changes.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues block the clone export and DNS activation changes.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues block the guest-side clone export and network settings changes.

No open issues 🎉

_{Review effort: Balanced}